Spot & Avoid Phishing After a Data Breach

After a company you trust suffers a data breach, your email, passwords, or personal details may be in the hands of criminals. This guide shows you how to spot the phishing emails, texts, and calls that almost always follow, and how to avoid falling for them. You’ll learn the red flags to look for, the exact steps to verify a suspicious message, and what to do if you’ve already clicked something you shouldn’t have.

What You’ll Need

• Access to the breached company’s official website (not from a link in the suspicious message).
• A password manager (optional, but helpful for checking if you reused passwords).
• Two-factor authentication (2FA) app or hardware key (recommended, but not required to start).

Step-by-Step

1. Check if you were actually affected. Go directly to the company’s official website or use a trusted news source. Look for a breach notice or press release. If they offer a breach checker (where you enter your email), use it — but only on their official domain, never through a link in an email or text.
2. Change your password for that account immediately. Even if you’re not sure you were affected, change it. Use a strong, unique password (a passphrase of 4-5 random words is good). Do this on the company’s website, not through a link in any message.
3. Change any other accounts that use the same password. If you reused the password for other sites, change those too. This is critical because attackers will try your email and password on banking, social media, and shopping sites.
4. Turn on two-factor authentication (2FA) for the breached account and your email. Use an authenticator app or a hardware key, not SMS if possible. This adds a second check so a stolen password alone isn’t enough.
5. Be extra suspicious of any message that mentions the breach. In the days and weeks after a breach, expect phishing emails that say things like “Your account was compromised — click here to reset your password” or “We’ve detected unusual activity — verify your identity.” These are almost always fake.
6. Hover over links before clicking. On a computer, hover your mouse over any link to see the actual URL in the bottom-left corner of your browser. On a phone, press and hold the link to preview it. If the URL looks odd (e.g., company-security.com instead of company.com/security), do not click.
7. Check the sender’s email address carefully. Phishers often use addresses that look similar to the real one but have a typo or extra word (e.g., support@company-security.com instead of support@company.com). Look at the part after the @ symbol.
8. Look for generic greetings and urgent language. Legitimate companies usually address you by name. Phishing emails often use “Dear Customer” or “Dear User” and create a false sense of urgency: “Your account will be closed in 24 hours” or “Immediate action required.”
9. Don’t download attachments from suspicious emails. Attachments can contain malware. If you weren’t expecting a file, don’t open it. Even if it looks like a PDF or Word doc, it could be malicious.
10. If a message asks for personal information, delete it. Legitimate companies never ask for your password, Social Security number, or credit card number via email or text. If you get such a request, it’s phishing.
11. Call the company directly if you’re unsure. Use the phone number on the company’s official website (not the one in the message). Ask if the message is legitimate. This is the most reliable way to verify.
12. Report phishing attempts. Forward suspicious emails to the company’s abuse address (often abuse@company.com) or to the FTC at reportfraud.ftc.gov. Also report to your email provider by using the “Report phishing” button.

Common Mistakes

• Clicking links in a hurry. Phishing works because it makes you act fast. Always pause and verify the URL before clicking.
• Trusting the display name. An email can say “From: Company Support” but the actual address is something else. Always check the email address, not just the name.
• Assuming the breach notice is fake. Some people ignore real breach notifications because they think they’re phishing. That’s dangerous. If you get a notice, verify it by visiting the official site, but don’t ignore it.
• Reusing passwords. Even if you change the breached password, if you reuse it elsewhere, attackers will try it on other sites. Always use unique passwords.
• Answering phone calls that sound official. Scammers can spoof caller ID to show the company’s real number. If they ask for personal info, hang up and call back on the official number.

Tips

• Use a password manager. It generates and stores strong, unique passwords for each site, so you don’t have to remember them.
• Enable 2FA everywhere you can. It’s the single most effective way to protect your accounts.
• Keep your software updated. Updates often include security patches that protect against known vulnerabilities.
• If a message seems off, trust your gut. If something feels wrong, it probably is. Verify through official channels.
• Use a separate email for financial accounts. That way, a breach of a shopping site doesn’t give attackers your main email.

Troubleshooting

What if you already clicked a link or entered your password? Don’t panic. Act quickly:

• Change the password on that account immediately, and on any other account that uses the same password.
• Run a virus scan on your device if you downloaded an attachment.
• Contact the company’s official support to alert them.
• Monitor your bank and credit card statements for unusual activity. If you see any, report it to your bank.

What if you can’t change your password because the site is down? Wait a few hours and try again. If it’s still down, contact support. In the meantime, keep an eye on your email for any suspicious activity.

What if the phishing email looks exactly like the real one? Some phishing emails are very sophisticated. If you can’t tell, don’t click. Instead, go directly to the company’s website by typing the address manually, and log in there. If there’s a real problem, you’ll see a notification on your account.

Frequently Asked Questions

How soon after a breach should I expect phishing attempts?

Usually within days, sometimes hours. Attackers move fast, so change your passwords as soon as you hear about the breach.

Can phishing happen via text message or phone call?

Yes, it’s called smishing (SMS) and vishing (voice). The same rules apply: don’t click links in texts, and don’t give personal info over the phone. Hang up and call the official number.

Is it safe to click a link in a breach notification email?

No. Even if the email is real, it’s safer to type the company’s URL directly into your browser. That way you know you’re on the real site.

What if I don’t have an account with the company that was breached?

Then you’re likely not affected. But if you’re not sure, check the company’s official site. Sometimes breaches affect people who never had an account (e.g., if the company stored data from a partner).

Should I freeze my credit after a data breach?

If the breach involved financial information (like credit card numbers or Social Security numbers), freezing your credit with the three major bureaus (Equifax, Experian, TransUnion) is a good precaution. It’s free and doesn’t affect your credit score.

How do I know if my password was in the breach?

Use a service like Have I Been Pwned (haveibeenpwned.com) to check if your email or phone number appears in known breaches. It’s a legitimate, widely used service. But don’t click any links in emails claiming to be from them — go to the site directly.

Related

• Compare Gas & Electricity Plans by Total Cost
• Fix Capistrano Deployment Failures on Rails
• Restore Accidentally Cleared Data on Kodi